linux-kernel - Re: [PATCH v2] ovl: Fix uninit-value in ovl_fill

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20260128024212.1818250-1-wangqing7171@gmail.com>
Date: Wed, 28 Jan 2026 10:42:12 +0800
From: Qing Wang <wangqing7171@...il.com>
To: miklos@...redi.hu
Cc: amir73il@...il.com,
	linux-kernel@...r.kernel.org,
	linux-unionfs@...r.kernel.org,
	syzbot+d130f98b2c265fae5297@...kaller.appspotmail.com,
	wangqing7171@...il.com
Subject: Re: [PATCH v2] ovl: Fix uninit-value in ovl_fill_real

On Tue, 27 Jan 2026 at 19:19, Miklos Szeredi <miklos@...redi.hu> wrote:
> diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
> index 160960bb0ad0..9ea3cd11dd93 100644
> --- a/fs/overlayfs/readdir.c
> +++ b/fs/overlayfs/readdir.c
> @@ -755,7 +755,7 @@ static bool ovl_fill_real(struct dir_context *ctx, const char *name,
>         struct dir_context *orig_ctx = rdt->orig_ctx;
>         bool res;
>
> -       if (rdt->parent_ino && strcmp(name, "..") == 0) {
> +       if (rdt->parent_ino && namelen == 2 && !strncmp(name, "..", namelen)) {
> 
> Yeah, and also the str... functions only make sense on null terminated
> strings, so that needs to be memcmp.

Thanks for your idea, but I think strncmp is same as memncmp in this case.
strncmp dons't use null terminated.

```
int strncmp(const char *cs, const char *ct, size_t count)
{
	unsigned char c1, c2;

	while (count) {
		c1 = *cs++;
		c2 = *ct++;
		if (c1 != c2)
			return c1 < c2 ? -1 : 1;
		if (!c1)
			break;
		count--;
	}
	return 0;
}
```

What do you think?

--
Best Regards,
Qing